cargo-no-dev-deps

behavior

.github/.cspell/project-dictionary.txt

@@ -2,6 +2,7 @@ almalinux
 archlinux
 binstall
 callgrind
+CDPATH
 coreutils
 covgate
 cyclonedx
@@ -29,7 +30,6 @@ pluginconf
 ppcle
 prek
 quickinstall
-rclone
 rdme
 rootfs
 sccache

.github/workflows/ci.yml

@@ -33,20 +33,20 @@ concurrency:
 
 jobs:
   miri:
-    uses: taiki-e/github-actions/.github/workflows/miri.yml@dec917193d835117a7238865adf83273d9fcd27a # main
+    uses: taiki-e/github-actions/.github/workflows/miri.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
     with:
       # NB: sync with test job's --exclude option
       args: --exclude install-action-internal-codegen
   msrv:
-    uses: taiki-e/github-actions/.github/workflows/msrv.yml@dec917193d835117a7238865adf83273d9fcd27a # main
+    uses: taiki-e/github-actions/.github/workflows/msrv.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
   test-manifest-schema:
-    uses: taiki-e/github-actions/.github/workflows/test.yml@dec917193d835117a7238865adf83273d9fcd27a # main
+    uses: taiki-e/github-actions/.github/workflows/test.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
     with:
       # NB: sync with miri job's --exclude option
       test-args: --exclude install-action-internal-codegen
       no-std: false
   tidy:
-    uses: taiki-e/github-actions/.github/workflows/tidy.yml@dec917193d835117a7238865adf83273d9fcd27a # main
+    uses: taiki-e/github-actions/.github/workflows/tidy.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
     permissions:
       contents: write # for creating branch for pr
       pull-requests: write # unused (used in `codegen-automerge: true` case)

.github/workflows/manifest.yml

@@ -33,7 +33,7 @@ concurrency:
 
 jobs:
   manifest:
-    uses: taiki-e/github-actions/.github/workflows/gen.yml@dec917193d835117a7238865adf83273d9fcd27a # main
+    uses: taiki-e/github-actions/.github/workflows/gen.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
     permissions:
       contents: write # for creating branch for pr
       pull-requests: write # for gh pr review --approve

.github/workflows/release.yml

@@ -212,10 +212,10 @@ jobs:
         with:
           tool: parse-changelog
           fallback: none
-      - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
         id: push-token
         with:
-          app-id: ${{ secrets.PUSH_TOKEN_APP_CLIENT_ID }}
+          client-id: ${{ secrets.PUSH_TOKEN_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_TOKEN_APP_PRIVATE_KEY }}
       - name: Create and push release commit and tag
         id: push
@@ -427,7 +427,7 @@ jobs:
           PREPARE_REV: ${{ needs.prepare.outputs.rev }}
           # Note that if we use secrets.GITHUB_TOKEN, the pushed commit/tag cannot trigger other workflows.
           PUSH_TOKEN: ${{ steps.push-token.outputs.token }}
-      - uses: taiki-e/create-gh-release-action@f67cf7b2dadd83d36b981e674a6b08063997ce68 # v1.10.0
+      - uses: taiki-e/create-gh-release-action@eba8ea96c86cca8a37f1b56e94b4d13301fba651 # v1.11.0
         with:
           changelog: CHANGELOG.md
           title: $version
@@ -436,7 +436,7 @@ jobs:
 
   release-manifest-schema:
     if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action-manifest-schema'
-    uses: taiki-e/github-actions/.github/workflows/rust-release.yml@dec917193d835117a7238865adf83273d9fcd27a # main
+    uses: taiki-e/github-actions/.github/workflows/rust-release.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
     permissions:
       contents: write # for taiki-e/create-gh-release-action
       id-token: write # for rust-lang/crates-io-auth-action
@@ -451,3 +451,4 @@ jobs:
       changelog: tools/manifest-schema/CHANGELOG.md
       title: $prefix $version
       prefix: install-action-manifest-schema
+      commit-prefix: 'manifest-schema: '

CHANGELOG.md

@@ -10,6 +10,38 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+## [2.75.19] - 2026-04-21
+
+- Update `wasmtime@latest` to 44.0.0.
+
+- Update `tombi@latest` to 0.9.20.
+
+- Update `martin@latest` to 1.6.0.
+
+- Update `just@latest` to 1.50.0.
+
+- Update `mise@latest` to 2026.4.18.
+
+- Update `rclone@latest` to 1.73.5.
+
+## [2.75.18] - 2026-04-19
+
+- Update `vacuum@latest` to 0.26.1.
+
+- Update `wasm-tools@latest` to 1.247.0.
+
+- Update `mise@latest` to 2026.4.16.
+
+- Update `espup@latest` to 0.17.1.
+
+- Update `trivy@latest` to 0.70.0.
+
+## [2.75.17] - 2026-04-17
+
+- Update `tombi@latest` to 0.9.18.
+
+- Update `mise@latest` to 2026.4.15.
+
 ## [2.75.16] - 2026-04-17
 
 - Update `uv@latest` to 0.11.7.
@@ -32,7 +64,7 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 - Implement potential workaround for [windows-11-arm runner bug](https://github.com/actions/partner-runner-images/issues/169) which sometimes causes installation failure.
 
-  The issue where this bug affected the startup of bash was addressed in 2.71.2, but we received a report that the same problem seems to occur when starting other commands as well.
+  The issue where this bug affected the startup of bash was addressed in 2.71.2, but we received a report that the [same problem seems to occur when starting other commands as well](https://github.com/taiki-e/install-action/pull/1657#issuecomment-4252717651).
 
 - Update `cargo-deny@latest` to 0.19.2.
 
@@ -6287,7 +6319,10 @@ Note: This release is considered a breaking change because installing on version
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.75.16...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.75.19...HEAD
+[2.75.19]: https://github.com/taiki-e/install-action/compare/v2.75.18...v2.75.19
+[2.75.18]: https://github.com/taiki-e/install-action/compare/v2.75.17...v2.75.18
+[2.75.17]: https://github.com/taiki-e/install-action/compare/v2.75.16...v2.75.17
 [2.75.16]: https://github.com/taiki-e/install-action/compare/v2.75.15...v2.75.16
 [2.75.15]: https://github.com/taiki-e/install-action/compare/v2.75.14...v2.75.15
 [2.75.14]: https://github.com/taiki-e/install-action/compare/v2.75.13...v2.75.14

action.yml

@@ -4,8 +4,8 @@ description: GitHub Action for installing development tools
 inputs:
   tool:
     description: Tools to install (whitespace or comma separated list)
-    required: true
-    # default: #publish:tool
+    required: false
+    default: cargo-no-dev-deps
   checksum:
     description: Whether to enable checksums (strongly discouraged to disable)
     required: false
@@ -22,7 +22,10 @@ runs:
   using: composite
   steps:
     - run: |
-        set -eu
+        if /usr/bin/env | grep -Eq '^BASH_FUNC_'; then
+          printf '::error::bash function injection via BASH_FUNC_ environment variable is not allowed for security reasons\n'
+          exit 1
+        fi
         if ! command -v bash >/dev/null; then
           if grep -Eq '^ID=alpine' /etc/os-release; then
             printf '::group::Install packages required for install-action (bash)\n'
@@ -41,7 +44,7 @@ runs:
           fi
         fi
         bash --noprofile --norc "${GITHUB_ACTION_PATH:?}/main.sh"
-      shell: sh
+      shell: /usr/bin/env -u ENV -u BASH_ENV -u CDPATH -u SHELLOPTS -u BASHOPTS /bin/sh -eu {0} # zizmor: ignore[misfeature] false positive
       env:
         # NB: Sync with Windows case.
         INPUT_TOOL: ${{ inputs.tool }}
@@ -54,6 +57,15 @@ runs:
     # https://github.com/actions/partner-runner-images/issues/169
     - run: |
         Set-StrictMode -Version Latest
+        if (Test-Path "Env:ENV") { Remove-Item Env:\ENV }
+        if (Test-Path "Env:BASH_ENV") { Remove-Item Env:\BASH_ENV }
+        if (Test-Path "Env:CDPATH") { Remove-Item Env:\CDPATH }
+        if (Test-Path "Env:SHELLOPTS") { Remove-Item Env:\SHELLOPTS }
+        if (Test-Path "Env:BASHOPTS") { Remove-Item Env:\BASHOPTS }
+        if (Test-Path "Env:BASH_FUNC_*") {
+          Write-Output "::error::bash function injection via BASH_FUNC_ environment variable is not allowed for security reasons"
+          exit 1
+        }
         for ($i=1; $i -le 10; $i++) {
           $prev_err_action = $ErrorActionPreference
           $ErrorActionPreference = "Continue"

main.sh

@@ -453,6 +453,51 @@ canonicalize_windows_path() {
   esac
 }
 
+if [[ $# -gt 0 ]]; then
+  bail "invalid argument '$1'"
+fi
+
+# Inputs
+tool="${INPUT_TOOL:-}"
+tools=()
+if [[ -n "${tool}" ]]; then
+  while read -rd,; do
+    tools+=("${REPLY}")
+  done < <(normalize_comma_or_space_separated "${tool}")
+fi
+if [[ ${#tools[@]} -eq 0 ]]; then
+  warn "no tool specified; this could be caused by a dependabot bug where @<tool_name> tags on this action are replaced by @<version> tags"
+  # Exit with 0 for backward compatibility.
+  # TODO: We want to reject it in the next major release.
+  exit 0
+fi
+
+enable_checksum="${INPUT_CHECKSUM:-}"
+case "${enable_checksum}" in
+  true) ;;
+  false)
+    enable_checksum=''
+    warn "checksums have been disabled by 'checksum' input option; this is strongly discouraged for security reasons"
+    ;;
+  *) bail "'checksum' input option must be 'true' or 'false': '${enable_checksum}'" ;;
+esac
+
+fallback="${INPUT_FALLBACK:-}"
+case "${fallback}" in
+  none | cargo-binstall | cargo-install) ;;
+  *) bail "'fallback' input option must be 'none', 'cargo-binstall', or 'cargo-install': '${fallback}'" ;;
+esac
+
+# Unlike gh command, cargo-binstall reads GITHUB_TOKEN first via cli parser, and then reads GH_TOKEN.
+# https://github.com/cargo-bins/cargo-binstall/blob/v1.17.9/crates/bin/src/args.rs#L704
+token="${GITHUB_TOKEN:-"${GH_TOKEN:-"${DEFAULT_GITHUB_TOKEN:-}"}"}"
+# This prevents tokens from being exposed to subprocesses via environment variables.
+# Since the tokens remain in memory, setting `fallback: none` (which prevents the tokens from being
+# set in the first place) remains the best practice from a security standpoint, as readme says.
+# Note that this does not prevent token leaks via reading `/proc/*/environ` on Linux or
+# via `ps -Eww` on macOS. It only reduces the risk of leaks.
+unset GITHUB_TOKEN GH_TOKEN DEFAULT_GITHUB_TOKEN
+
 # Refs: https://github.com/rust-lang/rustup/blob/HEAD/rustup-init.sh
 base_distro=''
 exe=''
@@ -571,7 +616,7 @@ cargo_path=$(type -P cargo || true)
 if [[ "${host_os}" == "windows" ]]; then
   mkdir -p -- "${install_action_dir}"
   # See action.yml.
-  touch -- "${install_action_dir}"/init
+  printf '' >|"${install_action_dir}"/init
   if [[ -n "${cargo_path}" ]]; then
     info "cargo is located at ${cargo_path}"
     cargo_bin="${cargo_path%/*}"
@@ -591,52 +636,9 @@ fi
 export CARGO_NET_RETRY=10
 export RUSTUP_MAX_RETRIES=10
 
-if [[ $# -gt 0 ]]; then
-  bail "invalid argument '$1'"
-fi
-
 export DEBIAN_FRONTEND=noninteractive
 manifest_dir="${GITHUB_ACTION_PATH}/manifests"
 
-# Inputs
-tool="${INPUT_TOOL:-}"
-tools=()
-if [[ -n "${tool}" ]]; then
-  while read -rd,; do
-    tools+=("${REPLY}")
-  done < <(normalize_comma_or_space_separated "${tool}")
-fi
-if [[ ${#tools[@]} -eq 0 ]]; then
-  warn "no tool specified; this could be caused by a dependabot bug where @<tool_name> tags on this action are replaced by @<version> tags"
-  # Exit with 0 for backward compatibility.
-  # TODO: We want to reject it in the next major release.
-  exit 0
-fi
-
-enable_checksum="${INPUT_CHECKSUM:-}"
-case "${enable_checksum}" in
-  true) ;;
-  false)
-    enable_checksum=''
-    warn "checksums have been disabled by 'checksum' input option; this is strongly discouraged for security reasons"
-    ;;
-  *) bail "'checksum' input option must be 'true' or 'false': '${enable_checksum}'" ;;
-esac
-
-fallback="${INPUT_FALLBACK:-}"
-case "${fallback}" in
-  none | cargo-binstall | cargo-install) ;;
-  *) bail "'fallback' input option must be 'none', 'cargo-binstall', or 'cargo-install': '${fallback}'" ;;
-esac
-
-# Unlike gh command, cargo-binstall reads GITHUB_TOKEN first via cli parser, and then reads GH_TOKEN.
-# https://github.com/cargo-bins/cargo-binstall/blob/v1.17.9/crates/bin/src/args.rs#L704
-token="${GITHUB_TOKEN:-"${GH_TOKEN:-"${DEFAULT_GITHUB_TOKEN:-}"}"}"
-# This prevents tokens from being exposed to subprocesses via environment variables.
-# Since the tokens remain in memory, setting `fallback: none` (which prevents the tokens from being
-# set in the first place) remains the best practice from a security standpoint, as readme says.
-unset GITHUB_TOKEN GH_TOKEN DEFAULT_GITHUB_TOKEN
-
 case "${host_os}" in
   linux)
     if ! type -P jq >/dev/null || ! type -P curl >/dev/null || ! type -P tar >/dev/null; then

manifests/cargo-xwin.json

@@ -17,6 +17,24 @@
   "latest": {
     "version": "0.21.5"
   },
+  "0.22.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9F37C7CF1B98",
+      "hash": "a883bdc833df614978514485d00e6174fcc3a229bf0edc07bbea8762a0405e0b"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9F37FADC11D8",
+      "hash": "6a0ba0734f9c8af3c98338be34ad70a3010d1014b5e551134d3e087d46192ffd"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9F38104A6015",
+      "hash": "2d0e46a28b2919e92f6952dcd88c9a8f9a1e6426a6ef1319ff3a6ccaef264774"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9F37D403A82E",
+      "hash": "f4ec28c33817623c2f2638c11fc7f011d7ea2468d8b56ef590daa4032ee2e256"
+    }
+  },
   "0.21": {
     "version": "0.21.5"
   },

manifests/espup.json

@@ -18,7 +18,54 @@
     }
   },
   "latest": {
-    "version": "0.16.0"
+    "version": "0.17.1"
+  },
+  "0.17": {
+    "version": "0.17.1"
+  },
+  "0.17.1": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE9C74A098CB39",
+      "hash": "dd8625b3742b2f74ce406286baef8ee67525d63b25ea303ddf7473ed2cc31192"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9C747D3044B2",
+      "hash": "c51cf3d7a91c5e24de680812cf110fa58a4315ed80b8d1af8e74f89088d8b861"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9C748FE2165B",
+      "hash": "f3a2d372e6f04f67a2adb7ff310ad336d9d475a5c4ce2c0c7855792875981bf0"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE9C7475A3FBDB",
+      "hash": "9b0082414a962edfdd62aeebba07e8eaf3009477e78903a6bc656775f2f1dbe7"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9C74AB2E27B6",
+      "hash": "93bff02d2e3f37eb5c0ab68b2016fcbeb5e9aa0334f8f47e5ec63a219daace91"
+    }
+  },
+  "0.17.0": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE9C60D8405E5A",
+      "hash": "9b97234338a83c23e6324595ae861b190cc95fefeb257575f05327fe1f2cd77d"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9C60B152442B",
+      "hash": "366e7f1ba3aaf60d026a232d83cf75e0d9a977083ffba5a4ef90bb0732df4d11"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9C60C2BCF730",
+      "hash": "03049e76c11f174b3f32277545be53819a243af8e8c012e7c07e10314840e170"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE9C60A9AE250C",
+      "hash": "f6356701429f99b2bb6dc1d67aadb56bf3c3b09b6e583849d334068d5edda418"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9C60B3F2D0E4",
+      "hash": "7f7c5f38d15bbce54a910150ba295516985e3bf27abbacf81d8718bf7cf7521d"
+    }
   },
   "0.16": {
     "version": "0.16.0"

manifests/just.json

@@ -21,10 +21,39 @@
     }
   },
   "latest": {
-    "version": "1.49.0"
+    "version": "1.50.0"
   },
   "1": {
-    "version": "1.49.0"
+    "version": "1.50.0"
+  },
+  "1.50": {
+    "version": "1.50.0"
+  },
+  "1.50.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9E6F41A84659",
+      "hash": "27e011cd6328fadd632e59233d2cf5f18460b8a8c4269acd324c1a8669f34db0"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9E6F39943078",
+      "hash": "e4fa28fe63381ca32fad101e86d4a1da7cd2d34d1b080985a37ec9dc951922fe"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9E6F71190D2B",
+      "hash": "5dc713f049e174e22de41fd06292a26c9b90f2d37c1be9390d2082fe6928b376"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9E6F47F2EDF4",
+      "hash": "3beb4967ce05883cf09ac12d6d128166eb4c6d0b03eff74b61018a6880655d7d"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9E6F49FBDCE5",
+      "hash": "891262207663bff1aa422dbe799a76deae4064eaa445f14eb28aef7a388222cd"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9E6F73FB889D",
+      "hash": "91065b94d11beb4b05c8117d8a736e978f41764d73131de35d8134c9ab9dee7a"
+    }
   },
   "1.49": {
     "version": "1.49.0"

manifests/martin.json

@@ -31,10 +31,31 @@
     }
   },
   "latest": {
-    "version": "1.5.0"
+    "version": "1.6.0"
   },
   "1": {
-    "version": "1.5.0"
+    "version": "1.6.0"
+  },
+  "1.6": {
+    "version": "1.6.0"
+  },
+  "1.6.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9E6794FD4A72",
+      "hash": "b71c6e5006ab152ebe6ee021ba3280dadc681a1e723f48109ac4317d34c7926e"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9E6794344CFE",
+      "hash": "1a33cc0b9580ab5b7d9ba124113eb8db9cdd9191d6206a2e0d452d88b2ed40bc"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9E6794361FAD",
+      "hash": "42ef50d65d62358e806827f78ef660ef58eba126a449a237cbd57ab727105ea0"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9E6794327A4B",
+      "hash": "18afc12cdb9e84b095f26a260880ef488ea0185d6ff9821bb38d2b38d2b70d63"
+    }
   },
   "1.5": {
     "version": "1.5.0"

manifests/mise.json

@@ -27,13 +27,91 @@
     }
   },
   "latest": {
-    "version": "2026.4.14"
+    "version": "2026.4.18"
   },
   "2026": {
-    "version": "2026.4.14"
+    "version": "2026.4.18"
   },
   "2026.4": {
-    "version": "2026.4.14"
+    "version": "2026.4.18"
+  },
+  "2026.4.18": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9E2E39FC992B",
+      "hash": "dcb0187879dcd8adb0f26279f08f9b06f7b78fa3fea3fb95ffd4db72375201f4"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9E2E3C75312A",
+      "hash": "78b95c4a26d4c7f2bbda91dc119e1001eae33aade428f134dc6f1b6857a02cce"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9E2E3D783715",
+      "hash": "0651d43232b99d579f63ee83fa745f2418b37ae187b3f82322e9a2fd2192fe9f"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9E2E36AB5E0A",
+      "hash": "a451af75120d69139c3a88622299a893c2ef6eabdc80ec1226e2296ab6cc3432"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9E2E3B93975F",
+      "hash": "65b8e5f3a8654d725ff3af7781e447e2ed130dcdf412ee937cbd43ef64bb7629"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9E2E3D5D7A28",
+      "hash": "b2107c8a8a21ae6bf7d9e89efdb60a814864dd7b99c7770175896273bb798c0e"
+    }
+  },
+  "2026.4.17": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9D70541A0D1C",
+      "hash": "5c661249b75506bdc0a133d91460544b9a0c096c40cdb60a5c8d9e60bc144897"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9D705805C8FD",
+      "hash": "7925831a68bb119ae0a744408ab646b476f6309720b46d7f5ab466613ca7ada8"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9D705A337B82",
+      "hash": "51bf2412db91411717e5b34bfdf4ec86428abe20de5115c71c3c2ae96baee5de"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9D704E988A27",
+      "hash": "e9e47b246b73f84348736f48e909424865a01d0d5e853df51d77da33d53ae84d"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9D7056DA3305",
+      "hash": "ac0251f8ccbd48de250aa866a05637b74439b22f815a894bd47fce5d52e209e7"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9D7059853AF9",
+      "hash": "efbeb472c5e30ec6715ff3722a099c70191da00a2324cfdae16c4c2af3e55103"
+    }
+  },
+  "2026.4.16": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9C757DA1C42B",
+      "hash": "3dd389bee8684c6e8c400b2d44a33a1087981ae287b7c98816e3537f524287d7"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9C7580347D88",
+      "hash": "547f3ed469fc97808b8b82e776ad74f63ffa34ac93a6b2b40cb69473dcb4e240"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9C758180BD2A",
+      "hash": "9bf630a213b2cad0560a16ba6635d521b9c47d5fc48861c7a781805bb6c393b7"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9C757A63389F",
+      "hash": "5328c096b5a7aef266ee3c8495c3aab7f916c294c034b4488da2a7bdb40b76cf"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9C757F339817",
+      "hash": "b394f42bd7d3f9c4a1edd455f6839eaa32f14265fee8ab76888cf910e76e58ed"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9C758151F28A",
+      "hash": "82405507919f77784561d980da7f94cf5589c8d56503ada9d804996672324e04"
+    }
   },
   "2026.4.15": {
     "x86_64_linux_musl": {

manifests/prek.json

@@ -44,6 +44,40 @@
   "0.3": {
     "version": "0.3.9"
   },
+  "0.3.10": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9F997FFD1858",
+      "hash": "60a873474e2ff2f70a5ad524d1b51abb6fdf5991900001eb7c8979877d75dacd"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9F997F77B599",
+      "hash": "313882a8bfd76eb6930949ded36b23ce194ccb5431f474c62ae3fde12df100ae"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9F997FB515C3",
+      "hash": "43b85e061bbcf6febb9973a7859d029f29f5ddeeb7722bd234422d8b6bee4406"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9F997DF1BB18",
+      "hash": "50e585ce98988b70d79ec782b2cf6c787c2f0a97a448ba8594448b4a6a688943"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9F997DB040DC",
+      "hash": "e885e023ddb765ba31a2859bd4b9683f9b40fee3195c189a749bc4b28535ab5c"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9F997D9866DE",
+      "hash": "4a6de3ff0fc2049ca72b8ab0ec567e195362a22c7efcca7ef0824b36b55d4193"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE9F997F2903CC",
+      "hash": "029ba9576b560753b0a4374ace6c5df6808e3e935ae0d4a67a5935debc12dbd4"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE9F997F6EE5E2",
+      "hash": "bfe0c951b48cca6f91a85f83ec94a59cc567df988c0a7f23c0f34de0a232e08c"
+    }
+  },
   "0.3.9": {
     "x86_64_linux_musl": {
       "etag": "0x8DE9958BFB91B93",

manifests/rclone.json

@@ -27,13 +27,39 @@
     }
   },
   "latest": {
-    "version": "1.73.4"
+    "version": "1.73.5"
   },
   "1": {
-    "version": "1.73.4"
+    "version": "1.73.5"
   },
   "1.73": {
-    "version": "1.73.4"
+    "version": "1.73.5"
+  },
+  "1.73.5": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9E0C3BBE3A4E",
+      "hash": "932cf4b7484de74d82b4875488e0009469fd21f9904673385184520fe11a1bf0"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9E0D0D15BEE0",
+      "hash": "19c709563e455d8f8e343d5521e741afa7a77e37c6552ad8f7b03034f8bc214b"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9E0D47EF790D",
+      "hash": "201567c54304935112b06dfac4ad754786287fb5acfad8889feca8d1cdeba92b"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9E0C537CFE99",
+      "hash": "8d465c921d95b2f54c5f2e79b24c97742ebc2082a0b8709a686361bed5ba7932"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9E0D1603AE83",
+      "hash": "b9e265eb7a098743d0726c05c73fe207d355950fb8481e0b226c0c00173da1e8"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9E0D4F7F62B7",
+      "hash": "8805406a984115e7cfe3b021a20a983b7060a70f198484cf373d687b6f625923"
+    }
   },
   "1.73.4": {
     "x86_64_linux_musl": {

manifests/tombi.json

@@ -21,10 +21,62 @@
     }
   },
   "latest": {
-    "version": "0.9.17"
+    "version": "0.9.20"
   },
   "0.9": {
-    "version": "0.9.17"
+    "version": "0.9.20"
+  },
+  "0.9.20": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9E6CBAC4C2D3",
+      "hash": "9899e24f8dafe0ef63347b974704fdbbc9ab1e6a2346ad8ec629ff458746160a"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9E6CBA55DC08",
+      "hash": "cd793862d7916fefd92888f2441b20f8cce3d119cc5ed793da463ec6839b21fa"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9E6CBA72E04B",
+      "hash": "974170e908df51e169a4f773680f5eb857c5a483b6c2075933e779d8e366d8c5"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9E6CBA53E270",
+      "hash": "46a4cc79deae036def85651e36111225de2f11c6e2ff6e1d9c27ae8f3955a6aa"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9E6CBAE5459D",
+      "hash": "083523aeca0491787b773bb0fa719d36d918ba93ef405781f29e1b944e91915a"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9E6CBA571327",
+      "hash": "a72878a31f80a17db242d122c831ab0a3e53caafd5083b428409356e10737d33"
+    }
+  },
+  "0.9.19": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9E27872323BF",
+      "hash": "3a3d6523e1c39e76ffe9da8561ba48b01ffc8f885912813140afdb718c34d0c0"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9E2787CADC04",
+      "hash": "8b6e09d368b4adbeac18df1a21768d960ac3debd5d2a183040c5b2ac37722eae"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9E2787284E16",
+      "hash": "a04b6628a90e26d10dc2dda7ded6423e2f51a870551c8547f7c08678ffa3cd8c"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9E27871FCC29",
+      "hash": "ffa0b3b1f11161d28ac962388e3533d6ecb66c26c4b96694c64930ff2b4d0e6f"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9E278721C5C2",
+      "hash": "93cb44dc5c6c74b4e808d4490fec3b0be4a39e9550ba16d4c4140bb5b4945e3a"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9E2787B8A0FD",
+      "hash": "f93b714cb412e71d2ba3467e3b716d0821e3424fc60f9736e24a1c0156098c20"
+    }
   },
   "0.9.18": {
     "x86_64_linux_musl": {

manifests/trivy.json

@@ -31,7 +31,40 @@
     }
   },
   "latest": {
-    "version": "0.69.3"
+    "version": "0.70.0"
+  },
+  "0.70": {
+    "version": "0.70.0"
+  },
+  "0.70.0": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE9C4D820E1C11",
+      "hash": "8b4376d5d6befe5c24d503f10ff136d9e0c49f9127a4279fd110b727929a5aa9"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9C4D845AA570",
+      "hash": "52d531452b19e7593da29366007d02a810e1e0080d02f9cf6a1afb46c35aaa93"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9C4D85B4DEF4",
+      "hash": "eea5442eab86f9e26cd718d7618d43899e72a83767619e8bee47911bddbfb825"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE9C4D829357D2",
+      "hash": "2f6bb988b553a1bbac6bdd1ce890f5e412439564e17522b88a4541b4f364fc8d"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9C4D83C8A6C7",
+      "hash": "68e543c51dcc96e1c344053a4fde9660cf602c25565d9f09dc17dd41e13b838a"
+    },
+    "powerpc64le_linux_gnu": {
+      "etag": "0x8DE9C4D8582BCCA",
+      "hash": "ddc8fb59164e16a9973f46b77b7556de2923ac295731910822f0851ec9edfb01"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE9C4D81CDB213",
+      "hash": "92ec9caffdcc32d43b76d21d4ecd6ea2975a2b37e050d5f79e17651c490b1753"
+    }
   },
   "0.69": {
     "version": "0.69.3"

manifests/vacuum.json

@@ -21,7 +21,62 @@
     }
   },
   "latest": {
-    "version": "0.25.9"
+    "version": "0.26.1"
+  },
+  "0.26": {
+    "version": "0.26.1"
+  },
+  "0.26.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9CB74E5A88FF",
+      "hash": "e5981c4df9adfe21ab63cd8d00b073b2f11d09dc7382763da6a4ee00810bdcc2"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9CB74E5AAFE2",
+      "hash": "d1b778986b4e5aba1f533f340c8793a223880ee75f9f619c85e1cd7f06be7e65"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9CB74DAAC329",
+      "hash": "84d518e42fd436b64deef747e10b14efd54f295fc88af607fa79e78a9dac83aa"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9CB74DA2B5DE",
+      "hash": "48a32e9affd6b37904565fcaa83f31463f523697fd19cc87d27e1fbad8f76614"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9CB74E5510F4",
+      "hash": "d45dbc463b5cb77e440800bd8e47f735d5a97745615e5b77d1b0df850c81354b"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9CB74DA1A5A8",
+      "hash": "158e29510ae726ffd77a9c2278ff83f1ccb995835209000aeeedd88a51f08bd3"
+    }
+  },
+  "0.26.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9CA803D9C931",
+      "hash": "04e1b648096cc9fddab878fe03f1d2761c677afe5bb7e24b9814e6c28aa5b855"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9CA803E63E5C",
+      "hash": "f5618d20dcdb47e8dd8aa43e4abaa1cf5bba4f1b5cbd13e384f59cd1247fab7f"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9CA8048023EB",
+      "hash": "89c5e0b608f1cfe0e4651a7c4d533021d8a32fd36e6db607afb98b31e6906738"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9CA8047CF332",
+      "hash": "3f6c2c4386e594fd8f2ea407639943fca48a23aa298dd70dd29e81840eb1e800"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9CA803F7B6E0",
+      "hash": "7fdad92a67137af1a809be812137036af2a8c859fa2e08be8949a29ca47c8007"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9CA80486D327",
+      "hash": "52f14a24a79b47d2d2370f49e937b8c9b7dff457f815decfe9d744e25f64bd22"
+    }
   },
   "0.25": {
     "version": "0.25.9"

manifests/wasm-tools.json

@@ -23,10 +23,35 @@
     }
   },
   "latest": {
-    "version": "1.246.2"
+    "version": "1.247.0"
   },
   "1": {
-    "version": "1.246.2"
+    "version": "1.247.0"
+  },
+  "1.247": {
+    "version": "1.247.0"
+  },
+  "1.247.0": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE9C8F3E127F12",
+      "hash": "66a182ad1fc991f4f537d912e1f88f15f1e0bd734de46f2c60b11b884a44cab9"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9C8F3E2A5909",
+      "hash": "8ef61c8206f3bd29b0031b0fff7c3118c4d0b6b2f11bf87ff25ad6592bd42e32"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9C8F3E2A3225",
+      "hash": "33b11836688c3c134089e1f8cc1408288e0e0578a342fccc55b23c89e8440dd8"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE9C8F3D9639EA",
+      "hash": "df4343257da88340461ba9ad6886701d846721c21b5a65c05700ccd1e49104b7"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9C8F3DB0CFF1",
+      "hash": "593bdb6e396da19164dd3032c5d1441f263f16e8273e5b124a6322ff940bdf56"
+    }
   },
   "1.246": {
     "version": "1.246.2"

manifests/wasmtime.json

@@ -35,7 +35,47 @@
     }
   },
   "latest": {
-    "version": "43.0.1"
+    "version": "44.0.0"
+  },
+  "44": {
+    "version": "44.0.0"
+  },
+  "44.0": {
+    "version": "44.0.0"
+  },
+  "44.0.0": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE9EECC1A2BBAE",
+      "hash": "52eba06fe9f4364aa6164a4a3eafb2ca692ba9a756cbe8137b5574871f8cbfc8"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9EECC1F8DF49",
+      "hash": "cd8043448157abc72fa1bd1b9e66ede23e48fefbab80b2744763d25b65f69662"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9EECC356232C",
+      "hash": "6139de7554514c2df1e30cec9b1e6ca493685ece23a039f987b55bf32bc42a57"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE9EECBE872014",
+      "hash": "294cae921fb88cbbcb60a914eaaaf313df3249d718609afb5804186b3f1912f5"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9EECBEC6A0D2",
+      "hash": "38a3b9d9fe64cee21bc9d9268e2c19fa35a7be59e030717545b84da0e6514eab"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9EECBF6FB731",
+      "hash": "34d9e5b42b18893649c895d7794cad8866b82d1382fb5f2953ccf1306853a237"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE9EECC08BF58F",
+      "hash": "6e747f4ec40b1c5959ff002f147cbf1487a667cce42b690ad907ff0aefb0c707"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE9EECC0E549D0",
+      "hash": "2bbbaeb0114c7ca4c6b9f9cceed616cb19858f961ab34bab899e2c3e86d22d31"
+    }
   },
   "43": {
     "version": "43.0.1"

tools/tidy.sh

@@ -27,14 +27,14 @@ fi
 if [[ -n "${TIDY_DEV:-}" ]]; then
   image="ghcr.io/taiki-e/tidy:latest"
 else
-  image="ghcr.io/taiki-e/tidy@sha256:bce85a4321f80c09f2b68420e9149bcf7c085130ab1e1fca54443f76833cd184"
+  image="ghcr.io/taiki-e/tidy@sha256:71def761a5585e83a2672c4051aee13cd886ad5571215aee52f193454bb3cdff"
 fi
 user="$(id -u):$(id -g)"
 workdir=$(pwd)
 tmp=$(mktemp -d)
 trap -- 'rm -rf -- "${tmp:?}"' EXIT
 mkdir -p -- "${tmp}"/{pwsh-cache,pwsh-local,zizmor-cache,dummy-dir,tmp}
-touch -- "${tmp}"/dummy
+printf '' >"${tmp}"/dummy
 code=0
 color=''
 if [[ -t 1 ]] || [[ -n "${GITHUB_ACTIONS:-}" ]]; then